chore(security): remediate audit findings and lock vulnerable transitive deps

Author: brianfunk

docs/plan/M06-security-and-compliance-hardening.md

@@ -40,3 +40,4 @@ Implement engineering controls for a federal-ready baseline posture.
 - 2026-02-11: Added `docs/CONTROL_MAPPING.md` as baseline NIST/FISMA-style evidence mapping artifact.
 - 2026-02-11: Added migration `20260211000500_security_audit_and_abuse_events.sql` for append-only `audit_events` trigger capture across key tables and `abuse_events` telemetry storage.
 - 2026-02-11: Updated `supabase/functions/submit-comment/index.ts` to record abuse events for CAPTCHA failures/missing tokens, identity-gating failures, and rate-limit thresholds.
+- 2026-02-19: Ran dependency remediation for known audit findings; upgraded vulnerable runtime/tooling packages, added `minimatch` override to `10.2.1`, and reduced `npm audit` to moderate-only ESLint-chain advisories while preserving passing lint/typecheck/build.